Skip to content

add(web-panel): Web dashboard to facilitate the use of MHDDoS - #728

Merged
tester2024 merged 11 commits into
MatrixTM:mainfrom
foxredoficial:main
Aug 27, 2026
Merged

tester2024 merged 11 commits into
MatrixTM:mainfrom
foxredoficial:main

Conversation

@foxredoficial

Copy link
Copy Markdown
Contributor
image

Comment thread web/app.py

try:
proc = subprocess.Popen(
cmd,
Comment thread web/app.py Fixed
Comment thread web/app.py Fixed
Comment thread web/app.py Fixed
Comment thread web/app.py Fixed
Comment thread web/app.py Fixed
Comment thread web/app.py Fixed
Comment thread web/app.py Fixed
@tester2024

Copy link
Copy Markdown
Member

Please update host="0.0.0.0" to host="127.0.0.1" and add an environment variable or argument so users can change it to anything they want. Do the same for the port.

The reason for this is to ensure that no remote scanners can access the web panel. Also, if you add a login system (using a single secret key from .env or arguments), it would be even better.

@tester2024

Copy link
Copy Markdown
Member

also move install/run bat file to web directory or rename add web prefix

@tester2024

Copy link
Copy Markdown
Member

add bash too

…RF redirect flaw and add web bash/bat scripts
@foxredoficial

Copy link
Copy Markdown
Contributor Author

Hey @tester2024 Just pushed an update with everything:

  • Changed the default host to 127.0.0.1 (port 5000) and made both configurable via WEB_HOST/WEB_PORT env vars or --host/--port flags.
  • Added optional password protection using WEB_PASSWORD or --password flag.
  • Fixed the SSRF issue CodeQL picked up by disabling unvalidated redirects and adding strict URL checks.
  • Moved the scripts into the web folder with web-install and web-start (.bat for Windows and .sh for Linux).

Whenever you get a chance, could you approve the workflow so CodeQL can scan the new commit? Thanks!

Comment thread web/app.py Fixed
Comment thread web/app.py
return None
h_b64, p_b64, sig_b64 = parts
signing_input = f"{h_b64}.{p_b64}".encode('utf-8')
expected_sig = hmac.new(JWT_SECRET.encode('utf-8'), signing_input, hashlib.sha256).digest()
@tester2024
tester2024 merged commit 4e31b12 into MatrixTM:main Aug 27, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants